s4-s3-upgrade: convert password age policies to the negative NTTIME format